Microsoft Corp. (MSFT) warned that hackers are actively targeting customers of its document management software SharePoint, with security researchers flagging the risk of potentially widespread breaches around the world.
Vulnerabilities in the software have allowed hackers to access file systems and execute code, the US Cybersecurity and Infrastructure Security Agency warned on Sunday. While Microsoft said over the weekend that it had released a new patch for customers to apply to their SharePoint servers “to mitigate active attacks targeting on-premises servers,” the company was still working to roll out others to address ongoing security flaws.
Cybersecurity firms cautioned that a broad section of organizations may be affected by the breach. Tens of thousands — if not hundreds of thousands — of businesses and institutions worldwide use SharePoint in some fashion to store and collaborate on documents. Microsoft said hackers are specifically targeting clients running SharePoint servers from their own on-premise networks, as opposed to being hosted and managed by the tech firm. That could limit the impact to a subsection of customers.
Silas Cutler, a researcher at Michigan-based cybersecurity firm Censys, estimated that more than 10,000 companies with SharePoint servers were at risk. The US had the largest number of those companies, followed by the Netherlands, the UK and Canada, he said.
“It’s a dream for ransomware operators, and a lot of attackers are going to be working this weekend as well,” he said.
Microsoft has been trying to shore up its cybersecurity after a series of high-profile failures, hiring new executives from places like the US government and holding weekly meetings with senior executives to make its software more resilient. The company’s tech has been subject to several widespread and damaging hacks in recent years, and a 2024 US government report described the company’s security culture as in need of urgent reforms.
Palo Alto Networks Inc. warned that the SharePoint exploits are “real, in-the-wild, and pose a serious threat.” Google Threat Intelligence Group said in an e-mailed statement it had observed hackers exploiting the vulnerability, adding it allows “persistent, unauthenticated access and presents a significant risk to affected organizations.”
“When they’re able to compromise the fortress that is SharePoint, everybody is kind of at their whim because that is one of the highest security protocols out there,” said Gene Yu, CEO of Singapore-based cyber incident response firm Blackpanda.
The Washington Post reported that the breach had affected US federal and state agencies, universities, energy companies and an Asian telecommunications company, citing state officials and private researchers.
Researchers at Eye Security were the first to identify the vulnerability, Cutler said. They reported an intrusion on Friday resembling one identified earlier in the week in a demo by researchers Code White GmbH, which reproduced vulnerabilities presented by others at the Pwn2Own hacking contest.
Read the full article by Mark Anderson and Jane Lanhee Lee / Bloomberg
